# MpDefenderCoreService.exe

Windows Process: Microsoft Corporation

Also called mpdefendercoreservice, defender core service, mdcore

Windows, System Component

Microsoft Defender Core Service. It is a later Defender platform host that sits beside MsMpEng.exe, not a replacement filename for the scan engine.

## What you need to know

This is a Defender platform service. Antimalware Service Executable is still MsMpEng.exe.

MpDefenderCoreService.exe appeared as Microsoft split more Defender work out of a single engine process. Ending it does not uninstall Windows Security. It can leave protection inconsistent until the platform restarts.

- **Safe?**: Yes, with Defender

  **Same as MsMpEng?**: No. That one is the engine

  **Should I end it?**: Not if Defender is your antivirus

Feex says

If I see both MsMpEng and MpDefenderCoreService, I treat that as a current Defender platform, not two antivirus products fighting. Ending only the Core service is not a scan.

## What is MpDefenderCoreService.exe?

MpDefenderCoreService.exe is Microsoft Defender Core Service. It lives in the Defender platform version folder next to MsMpEng.exe.

## What does it do?

It supports platform work that Microsoft moved out of the classic engine process. MsMpEng.exe still does the file scan people see as Antimalware Service Executable.

## Why is it running?

Windows Security is the active antivirus and the Defender platform is current enough to ship the Core service. A third-party suite that disabled Defender should not leave this running as the owner.

## Is it safe?

Usually safe

The signed binary under the Windows Defender platform folder is Defender. A Core service exe on the desktop is not.

A legitimate copy normally runs from:

`C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\MpDefenderCoreService.exe`

- Version folder changes with the platform
- Publisher: Microsoft Corporation
- Sibling engine: MsMpEng.exe

## Can I end it?

Not recommended

Ending the Core service can stall platform tasks until Windows starts it again. End a scan wait by waiting, not by killing Defender hosts.

## Can I remove it?

No

Do not delete MpDefenderCoreService.exe. Change protection in Windows Security, or let another antivirus take the slot.

## Should it start with Windows?

The Defender platform starts it. It is not a chat tray you uncheck.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Usually lower than a full MsMpEng scan

  **Memory**: Moderate

  **Disk**: Low to moderate during platform work

  **Network**: Definition and platform updates

## File information

| Executable name        | MpDefenderCoreService.exe                                                                |
| ---------------------- | ---------------------------------------------------------------------------------------- |
| Common legitimate path | C:\ProgramData\Microsoft\Windows Defender\Platform\\\<version>\MpDefenderCoreService.exe |
| Publisher              | Microsoft Corporation                                                                    |
| Signature expectation  | Signed by Microsoft Windows                                                              |

## Common problems

### Two Defender names scare people

Engine plus Core service is a platform split. It is not a second unpaid antivirus.

### Debloat scripts disable the Core service

That leaves Windows Security in a half state. Turn it back on if Defender is still the owner.

## Troubleshooting

Diagnose before you change anything destructive.

### Check Windows Security for the active provider

If another product owns antivirus, this service should not be your first hunt.

### Do not mix it up with NisSrv

NisSrv is network inspection. MsMpEng is the scan. This is the Core service.

## Technical details

Technical details

| Image name | MpDefenderCoreService.exe   |
| ---------- | --------------------------- |
| Family     | Microsoft Defender platform |

## Related

These entities connect to this article. Type is shown on every link.

[MsMpEng.exe: Windows Process](https://feex.it/wiki/process/msmpeng.exe)[NisSrv.exe: Windows Process](https://feex.it/wiki/process/nissrv.exe)[Windows Defender: Windows Service](https://feex.it/wiki/service/windows-defender)[Windows Security: Application](https://feex.it/wiki/software/windows-security)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Defender Antivirus ](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)· Platform components
- [Microsoft Learn: Defender updates ](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-updates)· Platform version folder
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: MpDefenderCoreService.exe

  **Typical path**: C:\ProgramData\Microsoft\Windows Defender\Platform\\\<version>\MpDefenderCoreService.exe

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

  **Related process**: [MsMpEng.exe](https://feex.it/wiki/process/msmpeng.exe)

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/mpdefendercoreservice.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)